[Resolved][Severity: Critical][Ransomware][Intrusion]

Tsurugi Town Handa Hospital: LockBit 2.0 broke in, the electronic medical record became unusable and normal care was impossible for about two months

Ransomware hit before dawn on October 31, making the medical record system, holding about 85,000 patients' records, unusable. Normal care resumed on January 4, 2022.

Disclosed

2021-10-31

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2021-10-31
Before dawn, several printers in the hospital began printing a ransom note at once, and a fault in the medical record system was noticed. The network was cut off and infection with ransomware was confirmed at 8 a.m. The hospital consulted the prefectural police, which accepted a damage report, set up a disaster response headquarters and declined emergency patients. It held a press conference and announced the case the same day. [1] [3]
2021-11-01
It suspended accepting new patients and similar services for the time being. [1]
2022-01-04
Normal care resumed. [2]
2022-06-16
It published the report of its expert committee. [2] [3]

Impact and cause

Data on the main medical record server (records of about 85,000 patients), related servers and terminals in the hospital was encrypted, and the backups were suspected to be infected too. Emergency and new patients were turned away, operations were postponed where possible, and the hospital effectively stopped functioning. It took about two months to resume normal care. No leak of personal data was confirmed. [1] [2]

Cause

The expert committee's report said the ransomware was LockBit 2.0 and that the attacker probably got in by exploiting a vulnerability in the VPN device the hospital had installed. The police investigation continues. [3]